Cross-Site Request Forgery, or CSRF, is one of those vulnerabilities that feels simple after you understand it. The attacker does not need to steal a password. Instead, they abuse the fact that a user is already logged in.

Imagine an admin is signed in to a PHP dashboard. If the site allows sensitive actions through predictable requests, a malicious page could silently trigger actions in that admin’s browser. The browser automatically includes cookies, so the request may look legitimate to the server.

That is why every sensitive form in PHP should use a CSRF token.

A CSRF token is a random value stored in the user’s session and included inside the form. When the form is submitted, the server checks whether the submitted token matches the session token. If it does not match, the request is rejected.

Good CSRF protection starts with a strong random token. Use PHP’s random_bytes() function instead of weak random functions. The token should be unique per session, and for high-risk actions, you may generate a fresh token per form.

Sensitive actions should use POST, not GET. A link like /delete.php?id=10 is dangerous because it can be triggered by a simple image tag, link, or redirect. Deleting users, changing passwords, updating billing, changing email addresses, and modifying API keys should always require POST plus CSRF validation.

SameSite cookies add another layer. Setting your session cookie to SameSite=Lax or SameSite=Strict helps reduce cross-site cookie sending. However, SameSite should not be your only CSRF defense because browser behavior and business flows can vary.

Also be careful with APIs. If your PHP app has JSON endpoints used by a browser session, they may need CSRF protection too. Do not assume CSRF only applies to old HTML forms.

A clean CSRF implementation should include:
Token generation
Token validation
Token failure logging
Clear error handling
Session regeneration after login
POST-only sensitive actions

NeoShield’s practical advice is simple: if a request changes something important, protect it. CSRF is not difficult to prevent, but it is very easy to forget when building fast.